Install Hubble Web Server

This section will guide you through the steps necessary to setup a Hubble Web Server. If you have decided to use more than one web server, you will need to repeat these steps for each of them.

Before Deployment Day

Listed below are the actions that should be performed before the deployment date.

Prerequisites

You will need to provide the Web Server’s host machines based on a Windows Server 2016, Windows Server 2019 or Windows Server 2022 platform. The following sections will detail their configuration requirements. Note that these requirements will be tested by the Hubble Web Server installer and the installation will not proceed until the requirements are all met.

Elevated Permissions

Administrator privileges/elevated permissions are required for the user installing Hubble Web on the Windows web server machine as the deployment package, which installs Chef and deploys installation files, requires permission from an Administrator or Administrator user to install on a machine.

Elevated permissions are also required to run the batch file (run.bat, located within the Chef directory), as Chef will check during the configuration of Hubble Web whether or not the correct Windows features are installed, and this check (and any required installs), requires Administrator level permissions.

Anti-Virus/Anti-Malware Software

Any installed and running anti-virus/anti-malware software will need to be temporarily disabled before installing Chef via the deployment package and then configuring Chef via the batch file. The reason for this is that during the checks of installed Windows features, any automatic scan being performed by the anti-virus/anti-malware software will slow down theses checks and the configuration of Hubble Web due to the amount memory being used by the process.

Once configuration is complete and Hubble Web is installed on the windows web server, the anti-virus/ anti-malware software can be enabled again and if necessary a scan of the machine can then be performed to make sure nothing untoward is present.

Add Roles and Features

Below are the Roles and Features that need to be installed as a minimum before Hubble Web can be installed on the Windows machine:

When installing the above Windows features, it is likely that the web server feature will not have been installed yet, meaning that the Server Roles features will require configuration in the Add Roles and Features Wizard, as follows:

1. In the Add Roles and Features Wizard, when you enter the Features part of the Wizard, the screen below is displayed.
   Install the IIS Management Console by leaving the Include management tools (if applicable)
   checkbox ticked. Then click on Add Features.

   

2. The screen below is then displayed (note that the Web Server Role (IIS) heading will have been added to the list of parts of the wizard on the left of the screen under Features). Click Role Services.

   

3. The screen then displays the list of role services. Check the checkboxes for the required role services. The minimum required services are listed at the beginning of this topic.
4. Once all roles and features are selected, install them (either through download from Microsoft or from provided windows files).

Internet Access

Internet access may be required when installing the Windows features above, if they require downloading from Microsoft, or when installing Windows updates. If a proxy is required to access the internet, this will need be configured on the web server. Once Hubble deployment has finished, internet access can be removed again.

Windows Updates

After the minimum Microsoft components and minimum roles and features have been installed as described above, all Windows updates will need to be installed, as updates to the .NET Framework are required, including .NET Framework 4.8.

Minimum Microsoft Components Required

As well as the Roles and Features required, an additional Microsoft Component needs to be installed before Hubble Web can be accessed successfully. After all the available Windows updates are installed, please check whether the following is installed, and install it manually if not:

• IIS URL Rewrite Module - This will not be installed as standard and will need to be installed by downloading the module from:
• https://www.iis.net/downloads/microsoft/url-rewrite

Run the Hubble Web Installer

This standard Windows installer includes the prerequisite test script which you should run before deployment.

1. In order to install Hubble Web, you must log into the Windows server machine as an Administrator or as a user that has Administrator rights.
2. Copy or download the installation file to Windows server, either into a new directory or in the Downloads directory as required. The file is called:
   

   Hubble_Web_<version number>_<ERP>.exe,

   
   ...where <version> will be the current version and <ERP> will be the platform (i.e. JDE or EBS).
3. Double-click on the installation file to install the relevant files for chef, cookbooks, and to set up the installation for the next step.
4. During the installation, you will see a command prompt showing the current status of the installation, for example:

   

5. You will be prompted to enter the IP address or DNS name of your application server:

   

6. You will be prompted to enter either Yes or No to encrypt the password. If no response is provided within 120 seconds, No will be selected as the default option.

   

Verify the Prerequisites

Open a Windows PowerShell command prompt and navigate to the directory C:\Insight. Run the command:

This will run the prerequisite tests. All the prerequisite tests must pass (shown as green) for deployment to go ahead, otherwise please perform the hardware and software changes necessary to meet the prerequisites and re-run the command.

If you get the error message “The file C:\Insight\DVT.ps1 is not digitally signed.” when running this script, please see the Troubleshooting section.

Occasionally, Microsoft issues a 'KB' update which supersedes and deprecates a previously published one, causing our prerequisite test to become out of date. If you find that one of the required updates is no longer available, or refuses to install, this might have happened. In such cases Hubble Customer Services will be able to provide a work around on deployment day.

On Deployment Day

Complete The Setup of Hubble Web Server

Caution: The Application Server needs to be installed and its services running before this part of the web server deployment can be carried out.

1. Open a command prompt, navigate to c:\chef, and then execute our run.bat deployment script. This will retrieve the web configuration file (run-list.json) from the Hubble Application Server and install and/or configure all the tools, files and services needed to run Hubble Web (e.g. IIS, Hubble services, click-once, etc).

   

1. The deployment script will first run tests to confirm whether the web server meets the pre- requisites for Hubble. This will also verify that required services such as IIS are running on the web server and that it has network connectivity to the services already running on the Hubble Application server.

   

2. Positive test results will be displayed in green while any failed ones will be displayed in red.

   
   Every test will need to be successful or the Hubble installation will not proceed. If any test fails, a message will be displayed and the installation terminated to allow resolution of the failures.

3.  If the tests are successful, the script will proceed with installing and configuring all the software. You can monitor the installation progress by either following the command line output or by checking the installation log file, C:\chef\solo.txt:

   

   

4. Once the installation/upgrade is complete, a successful entry in the log file should be as follows:

   

If the chef run fails you should have clear failure messages both in the command prompt output and in the log file. If this happens you should solve the issue if possible, or if not contact Hubble Customer Services to help unblock the installation.

2. Configuring Web Single Sign-On with SAML.
   Web Single Sign-On (SSO) must be configured on your web servers.
   To start the configuration, run the sso_config.ps1 script located in C:\Insight to populate the SSO configuration file with details of your identity provider. This updates the SSO and YellowBox configuration files accordingly and restarts the services needed for SSO to work.
   The default configuration file ssoconfig.json is automatically created in the path C:\Insight\YellowBoxWeb\Config on your web server(s). Every web server will have a default configuration file. Alternatively, you can have custom configuration files in other locations on your web server as long as they follow the same structure.
   When running the script, follow the following steps:
   1. ConfigFile - Enter the absolute file path of the SSO configuration file. This includes the location and the filename including the extension (e.g. C:\Insight\YellowBoxWeb\Config\ssoconfig.json). This file will be updated with the configuration which follows.
   2. YbConfigFile - Enter the absolute file path of the YellowBox configuration file. This includes the location and the filename including the extension (e.g. C:\Insight\YellowBoxWeb\Config\YellowBox.config). This file will be updated to ensure that the SSO Security Token Service is enabled.
   3. Logging Configuration - Press Enter to use existing logging configuration or input 'Y' to change the logging level to something else. The current Log Level is 'Warning'.
   4. Allowed Hosts - Press Enter to use the existing allowed hosts '*' (all hosts) or change it to a host of your choice.
   5. Security Token Service Configuration - This is the Service Provider configuration and is already automatically filled in, so unless any changes need to be made just press Enter to use the current values. These values include Service Name, Service Description, and Assertion Consumer Service URL.
   6. Partner Provider Configuration - This is the Identity Provider Settings which include:
      1. Partner Name - The partner identity provider name is the unique identifier for the IdP. This tends to be the metadata URL which configures SSO to use a link to your identity provider's metadata file.
      2. Partner SSO Service URL - The single sign-on service URL is the endpoint where SAML authentication requests are sent as part of SP-initiated SSO. This URL tells Hubble where to find the IdP.
      3. Certificate Path - The identity provider will provide you with a certificate. This must be downloaded to a convenient location and the absolute path provided in the configuration. This certificate is used to verify that the correct identity provider is being “talked” to.
      4. Partner Name - This must match with the Partner Name in step 6a, to let Hubble know which IdP to use for SSO.

See the screenshot below for an example of a script run using OneLogin settings:

3. The next step is to run the full suite of deployment verification tests, which will confirm that the deployment has completed successfully. Proceed as follows:
   1. Open a PowerShell window.
   2. Change directory to C:\Insight:
      

      cd C:\Insight

   3. Execute the following command:
      

      C:\Insight\DVT.ps1 all C:\chef\run-list.json

   

4. You should now be able to see the Hubble Web login page by accessing the following address in your browser:
   

   http://<application_server_ip_address>/ or
   http://<application_server_DNS_name>/

   The address will redirect you automatically if you are using HTTPS or a domain name, and you should then see a screen similar to this:

   

5. Once you reach this stage, the Hubble Web Server installation is completed.

Post Deployment Steps

You will now need to contact Hubble Customer Services in order to setup Hubble's data access, profiles, users and all other steps necessary to get Hubble up and running. For them to be able to do this, they will need your repository configuration file that is located in http://<application_server_ip_address>:591/click-once/RepositorySelection.xml url.

If you have decided to use ClickOnce to deploy the Designer application to Windows desktop clients, follow the steps in Hubble - Click Once in the Hubble Supplementary Deployment Topics guide to get access to them. If not, you'll need to use the standalone Designer installer for Windows (an msi file) provided by Hubble Customer Services.

Troubleshooting

• If Chef is failing to deploy with an error message in the solo.log such as FATAL: Mixlib::ShellOut::CommandTimeout:, this might be caused by the System Time being incorrect. The deployment script attempts to sync the System Time, but if the machine is a VM, its Host can periodically override this Time causing the clock to change back and forth. In this scenario, Chef will miscalculate that the commands have taken longer to run than they should and trigger the Timeout error above. To resolve this, ensure the VM Host machine has its time set correctly and/or turn off the VMTools time sync functionality for the Guest Machine.
• When running the Hubble deployment script (C:\chef\run.bat) you might encounter permission issues with the included Powershell script. If that is the case, you will get a message similar to the following:

C:\Insight\DVT.ps1 : File C:\Insight\DVT.ps1 cannot be loaded. The file C:\Insight\DVT.ps1 is not digitally signed.

You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/

?LinkID=135170.

At line:1 char:1

+ C:\Insight\DVT.ps1 all C:\chef\run-list.json

+ ~~~~~~~~~~~~~~~~~~

+ CategoryInfo : SecurityError: (:) [], PSSecurityException

+ FullyQualifiedErrorId : UnauthorizedAccess

• To solve this, you will need to change the PowerShell execution policies by running the following command(s):

# (Optional) Run this command to check your current execution policies and take note of them

Get-ExecutionPolicy -List

Set-ExecutionPolicy -ExecutionPolicy Rem oteSigned

# (Optional) After running the H ubble deploym ent script (C:\chef\run.bat), you can revert your policies to their original state

Set-ExecutionPolicy -ExecutionPolicy <previous_state>

• Occasionally, when there are pending updates on the Web Server, the OS can lock some of the resources needed to install Hubble, and the run.bat deployment script will then fail. In such cases, restart the Web Server, and re-run run.bat.
• If you get the error “This implementation is not part of the windows platform fips validated cryptographic algorithms” during installation, this is because the web server has “FIPS Mode” enabled, which is limiting the cryptographic algorithms available.
  Hubble uses strong encryption and hashing algorithms provided by .NET, but not all of them are FIPS validated. Microsoft have written an article on why they no longer recommend FIPS mode, at least not for organizations who are not compelled to apply it. Guidance on how to resolve this is available online, e.g. on the Microsoft Support Team's IIS Blog.
• If you have specified an incorrect Appserver IP address/DNS hostname or wish to change it, the following options are available:
  • Delete the C:\chef\appserver.config file and run the installer again.
  • Alternatively, specify the correct Appserver as a parameter to the run.bat script. For example:
    c:\chef\run.bat 10.13.0.100
    This will update the appserver.config file with the new value.
    As detailed above, it is best to open a command prompt, navigate to the c:\chef directory and then execute the run.bat script.